AI
The Core Problem: Security Checks After Data Transforms
The talk frames every attack around CWE-180: security logic runs on data before something downstream transforms it. Think of a web stack as a telephone game. Data passes through CDNs, proxies, app tiers, and databases. Each hop may decode, normalize, or reinterpret strings differently. The attacker sends input that passes inspection, then the data mutates into something dangerous at the back end. Normalize first, inspect second. Getting that order wrong is the single thread connecting all five attack classes.
Multibyte Decoding Failures and Overlong Encoding
UTF-8 characters span 1 to 4 bytes. The leading bits signal byte count for a single character. An application that ignores those signals produces mojibake, garbled output unrelated to the original input. CWE-172 covers this. Overlong encoding packs a character into more bytes than required. The 2001 Nimda worm used overlong dot-slash sequences to bypass path traversal checks. SQLMap tamper scripts still use an overlong space to evade regex filters. ZAP, Burp Decoder Improved, and Active Scan++ were all updated during this research.
Byte Truncation and CRLF Injection
A bug hunter found CRLF injection on a Microsoft site using two Hangul characters instead of a carriage return and line feed. The CDN blocked the normal CRLF but passed the Hangul pair. The likely explanation: the application used a single-byte buffer. Each Hangul character is three bytes. The buffer keeps only one byte, strips the leading bit, and retains the least significant byte, which resolves to 0x0D and 0x0A. A tool called Shazer accepts a target byte value and returns Unicode characters that truncate to it.
Confusables, Unicode Casing, and Best-Fit Mapping
Unicode compatibility normalization maps lookalike characters to ASCII equivalents. Attackers use enclosed alphanumeric characters, like a circled 1, to represent 127.0.0.1 in SSRF payloads, bypassing IP address filters. In DotNetNuke, a file upload handler stripped dots via regex, then applied Windows code page 1251 best-fit mapping. Full-width fullstop characters survived the regex and mapped to ASCII dots, producing a UNC path that leaked credentials. A separate casing attack exploits the dotless-i (U+0131): Python’s uppercase() converts it to capital ASCII I, enabling an XSS payload that passed the original filter.
Combining Diacritics: Account Takeover via Database Collation
MySQL’s utf8mb4_0900_ai_ci collation is accent-insensitive and case-insensitive by default. An attacker submits a password-reset request with an accented A in the email address. The database treats accented A as equivalent to plain A, confirms the account exists, and issues a reset token. The application then sends the token to the attacker’s address rather than the one stored in the database. Separately, appending a combining long solidus overlay to a greater-than sign converts it to a “not greater than” character, breaking HTML tag context and enabling an onfocus XSS payload.
Variation Selectors and Invisible LLM Jailbreaks
Unicode variation selectors are non-rendering characters that modify how a following character displays. They have no visible output on their own. When injected into text sent to a large language model, they add tokens the model processes but the user cannot see. The extra tokens shift the model’s probability distribution, bypassing refusal behavior. A tool called ASCII Smuggler applies these characters to make arbitrary strings invisible. Combined with byte truncation, the modifier bytes get stripped and the underlying character, such as a less-than sign, becomes active.
Q&A
Have you tested collation behavior in databases other than MySQL? Ryan focused specifically on MySQL’s utf8mb4_0900_ai_ci default; the accent-insensitive, case-insensitive setting is on by default, which is why researchers flagged it publicly. ▶ 41:21
Could combining diacritics be used to nullify quote characters for SQL injection? Isabella found no Unicode character that combines with a single or double quote to modify it; the greater-than symbol appears to be the only current example. ▶ 42:22
How do you address these issues in 15-to-20-year-old legacy codebases? Ryan recommended scanning with updated proxy tools, Burp, ZAP, and Caido, as the most practical first step, since a positive finding gives security teams concrete evidence to bring to developers. ▶ 43:43
Notable Quotes
Truth is, we don’t know. This is a Isabella Barnett · ▶ 14:59
total wrong order. Isabella Barnett · ▶ 31:22
works but they get this wrong a lot. Ryan Barnett · ▶ 39:23
Key Takeaways
- Normalize data before security checks run, not after; CWE-180 is the root cause across all five attack classes.
- MySQL’s default utf8mb4_0900_ai_ci collation treats accented and plain characters as equivalent, enabling password-reset account takeover.
- Burp, ZAP, and Caido all received new rules for multibyte decoding, byte truncation, confusables, and combining characters during this research.
About the Speaker(s)
Ryan Barnett is a web application defender with over two decades of experience. He works as a Principal Security Researcher on the Akamai Threat Research Team, supporting the App and API Protector product. He is a former SANS instructor and contributes to OWASP projects. His day job includes tier-2 triage for bug bounty reports across customer platforms, which is where the Unicode edge cases in this talk were first observed.
Isabella Barnett is a Software Engineering Intern at Databuoy, a gunshot detection and localization company, and a sophomore at George Mason University’s Honor’s College studying cybersecurity engineering. She holds 27 industry certifications and co-leads the Web Hacking Incident Database (WHID), an OWASP project. She developed the hands-on dojo labs accompanying this talk and presented the byte truncation, combining diacritics, and variation selector sections.